captchaforge 0.2.39

# pcap2fixture

Converts a captured HTTP exchange (PCAP / HAR / curl trace) into a
deterministic captchaforge bench fixture or
[`AdversarialCapture`][adv].

The capture path is opportunistic, drop a `.har` / `.pcap` / curl-
trace `.txt` into `tools/pcap2fixture/incoming/` and the script
emits the appropriate fixture stub. Operators then commit the
fixture and add a regression test.

[adv]: ../../src/adversarial_replay.rs

## Workflow

1. Capture the real challenge exchange:
   ```bash
   # HAR (recommended: DevTools "Save all as HAR with content"):
   firefox-devtools → Network → ⋮ → Save All As HAR

   # OR curl trace:
   curl -v --trace-ascii captured.txt https://protected-site.example/

   # OR tcpdump PCAP (for non-TLS or after key-decryption):
   tcpdump -w captured.pcap -i any port 443
   ```
2. Drop the file in `tools/pcap2fixture/incoming/`.
3. Run:
   ```bash
   python3 tools/pcap2fixture/convert.py
   ```
4. The script writes:
   - **For bench**: a new `bench/src/fixtures.rs` HTML constant
     under `// 41. <vendor> (captured)` plus the matching
     `bench/src/server.rs` route registration.
   - **For adversarial-corpus**: an `adversarial_replay::AdversarialCapture`
     JSON file under `adversarial-corpus/<vendor>/`.
5. `git add` + commit. CI now replays the capture forever.

## What `convert.py` knows about

- HAR v1.2, extracts the response body + status + headers from
  the first request matching a CF / hCaptcha / reCAPTCHA URL
  signature.
- curl `--trace-ascii`: parses the response section delimited
  by `<= Recv data` / `<= Recv header`.
- PCAP: placeholder; requires `scapy` + `tls-decrypt-secrets`.
  Use HAR if TLS keys aren't exportable.

## Status

`convert.py` is a stub today. Real implementation lands when the
first user-reported capture comes in. The PROTOCOL (incoming/ +
out shape) is locked so the script can be filled in incrementally
without disrupting fixture / corpus consumers.